CVE-2026-77601: OpenC3 COSMOS RCE Vulnerability

CVE-2026-77601 Overview

OpenC3 COSMOS contains an operating system command injection vulnerability [CWE-78] in its plugin installation logic. An authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api. When a plugin containing Python dependency metadata is subsequently installed, OpenC3::PluginModel.install_phase2 interpolates the attacker-controlled value into a shell command. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary commands to run as the openc3 service user with access to Redis and bucket credentials. The flaw affects versions 5.12.0 through 7.2.x and is fixed in version 7.3.0.

Critical Impact
Authenticated attackers can achieve remote code execution as the openc3 service user, gaining access to Redis and object storage credentials that back the COSMOS deployment.

Affected Products

OpenC3 COSMOS 5.12.0 through 7.2.x (open-source deployments)
OpenC3 COSMOS Enterprise 5.12.0 through 7.2.x (administrator-only path)
OpenC3 COSMOS versions prior to 7.3.0

Discovery Timeline

2026-09-23 - CVE CVE-2026-77601 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77601

Vulnerability Analysis

OpenC3 COSMOS exposes an API endpoint that allows authenticated users to write application settings, including pypi_url. This URL is later used during plugin installation when the plugin declares Python dependencies. The install routine in openc3/lib/openc3/models/plugin_model.rb interpolates the stored pypi_url value directly into a shell command string passed to a subprocess. Because no validation or shell escaping is applied, shell metacharacters such as ;, |, `, and $() are honored by the invoked shell.

Exploitation results in arbitrary command execution as the openc3 service user. That process context holds credentials for Redis and the backing object storage buckets, exposing telemetry, command definitions, and stored artifacts. In open-source deployments any authenticated user can reach the affected operations. Enterprise deployments require administrator privileges to modify the setting.

Root Cause

The root cause is unsanitized string interpolation of a user-controlled configuration value into a shell command. The plugin installer trusted pypi_url as a benign URL rather than an untrusted input and relied on shell invocation rather than argument-array subprocess execution.

Attack Vector

An authenticated actor sends a POST /openc3-api/api request invoking set_setting to overwrite pypi_url with a value containing shell metacharacters. The actor then triggers installation of a plugin whose manifest declares Python dependencies, causing install_phase2 to execute the crafted command.

ruby

# Patch excerpt: openc3/lib/openc3/models/plugin_model.rb
 require 'openc3/models/widget_model'
 require 'openc3/models/microservice_model'
 require 'openc3/api/api'
+require 'openc3/utilities/pypi_url'
 require 'tmpdir'
 require 'tempfile'
 require 'fileutils'
+require 'open3'

 module OpenC3
   class EmptyGemFileError < StandardError; end

ruby

# Patch excerpt: openc3/lib/openc3/models/python_package_model.rb
 require 'fileutils'
 require 'openc3/utilities/process_manager'
+require 'openc3/utilities/pypi_url'
 require 'openc3/api/api'
 require 'pathname'

Source: OpenC3 COSMOS commit be70d1d. The patch introduces a dedicated pypi_url utility for validation and switches to open3 for safer subprocess handling.

Detection Methods for CVE-2026-77601

Indicators of Compromise

API requests to POST /openc3-api/api invoking set_setting with a pypi_url value containing shell metacharacters such as ;, |, `, $(, or &&.
Unexpected child processes spawned by the openc3 service user, particularly shells (sh, bash) or interpreters (python, curl, wget) launched during plugin installation.
Anomalous access to Redis or object storage credentials from the COSMOS container shortly after a plugin install event.

Detection Strategies

Audit application logs for set_setting calls that modify pypi_url and correlate them with subsequent plugin install actions.
Monitor process ancestry from the COSMOS Ruby process for shell invocations that do not match expected pip command patterns.
Alert on outbound network connections from the COSMOS container to hosts other than the configured PyPI mirror.

Monitoring Recommendations

Enable API access logging on /openc3-api/api and forward events to a centralized logging platform.
Baseline the expected pypi_url value and alert on any change.
Track file system writes and credential access under the openc3 service user's context.

How to Mitigate CVE-2026-77601

Immediate Actions Required

Upgrade OpenC3 COSMOS to version 7.3.0 or later.
Rotate Redis credentials and object storage bucket keys accessible to the openc3 service user if the platform ran an affected version.
Review audit logs for unauthorized set_setting calls modifying pypi_url since deployment of any version between 5.12.0 and 7.2.x.

Patch Information

The fix is included in OpenC3 COSMOS 7.3.0. See GitHub Security Advisory GHSA-vp3w-52v9-q57f, Pull Request #3489, and commit be70d1d. The patch introduces a pypi_url validation utility and replaces shell interpolation with open3 argument-array subprocess calls.

Workarounds

Restrict network access to the /openc3-api/api endpoint to trusted administrators only until the upgrade is applied.
In open-source deployments, review and reduce the set of authenticated accounts that can call set_setting.
Manually reset the pypi_url setting to a known-good value and monitor it for changes.

bash

# Verify installed OpenC3 COSMOS version and confirm 7.3.0 or later
docker exec openc3-cosmos-cmd-tlm-api \
  ruby -e "require 'openc3/version'; puts OpenC3::VERSION"

# Inspect the current pypi_url setting for injected metacharacters
curl -s -H "Authorization: <token>" \
  -X POST https://<cosmos-host>/openc3-api/api \
  -d '{"jsonrpc":"2.0","method":"get_setting","params":["pypi_url"],"id":1}'